87420788be7b2241b10c4a263486f339ee928d7c29d872c21188ac9adb59c42a

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 04:11

Target

8e2f7bf7f7a45f9af3e9fcd046216dfd.dll
Size

20KB
MD5

8e2f7bf7f7a45f9af3e9fcd046216dfd
SHA1

b0b5ef9608bc65eb4520d1cc25e6a13c5a4d56b2
SHA256

87420788be7b2241b10c4a263486f339ee928d7c29d872c21188ac9adb59c42a
SHA512

579e5e73a46c3a5895b99da21d21701a917b171bb3b8f2108589dc3b8b1364e9c1daa8bd886de91db6d48c67c28dc5aa4eabef6edd54963a1064b00f452a57f9
SSDEEP

384:q4ZSdI/FtcXLKOCa6P2Jiy16Qys39uMqdn3UgVdSopKYR2Puw2tPwXkvd14M6j:y08fbJiQyM9vm3bSoQYRFw+It/

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/464-0-0x0000000010000000-0x0000000010012000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 464	400	rundll32.exe	85
PID 400 wrote to memory of 464	400	rundll32.exe	85
PID 400 wrote to memory of 464	400	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e2f7bf7f7a45f9af3e9fcd046216dfd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e2f7bf7f7a45f9af3e9fcd046216dfd.dll,#1
  2⤵
  PID:464

memory/464-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download